-Option and Azure.Resource.AllowedRegions

[paulmccrady]

We have a situation that is currently very puzzling. If we run InFlight tests using Export-AzRuleData, followed either by Invoke-PSRule or Assert-PSRule without the -Option, we get good rule coverage and plenty of passing and failing tests (227 tests in total).

However, if we use the -Option with these commands we only see 15 tests run, all pass and all relate to the rule Azure.Resource.AllowedRegions.

The options file is a standard ps-rule.yaml taken from here with the exception of culture being set to en-GB and include module being set to PSRule.Rules.Azure.

Is there something in the standard options that is causing this ?

If we use an options file with Assert-PSRule to PreFlight test ARM Templates then we do not see the same behaviour, instead the Azure.Template rules fire as expected.

[BernieWhite]

@paulmccrady Potentially, agreed it is a little weird only Azure.Resource.AllowedRegions runs.

The default ps-rule.yaml in the docs is for illustration purposes about what the default configuration is. It's not really intended that you would copy and paste it directly.

This might cause an issue with PSRule for Azure because there are additional module configuration shipped in the module (https://github.com/Azure/PSRule.Rules.Azure/blob/main/src/PSRule.Rules.Azure/rules/Config.Rule.yaml)

Ultimately, the current design is you can override and maintain control of any of the defaults shipped as part of PSRule for Azure by setting these in options.

For clarity, you don't need to override the defaults by passing default values into -Option unless you don't like the default behaviour. From a DevSecOps perspective set anything critical that should not be overridden with environment variables, because these take priority.

The option that is likely to cause the issue is binding.targetType, because this affects how rules are matched against resources.

---

I hope that helps.